Administration and Best Practices

Running Neo4j in production requires attention to backup and recovery, security, monitoring, scaling, and performance tuning. This lesson covers the essential administration tasks and best practices.

---

Backup and Recovery

Backup Types

Type	Description	Command
Full backup	Complete copy of the database	neo4j-admin database backup
Incremental backup	Only changes since last backup (Enterprise)	neo4j-admin database backup --type=incremental
Dump	Offline export to a single file	neo4j-admin database dump

Full Backup

# Online backup (does not require stopping the database)
neo4j-admin database backup --to-path=/backups neo4j

Database Dump (Offline)

# Stop the database first
neo4j stop
neo4j-admin database dump --to-path=/backups neo4j
neo4j start

Restore

# Restore from a backup
neo4j-admin database restore --from-path=/backups/neo4j-backup neo4j

# Load from a dump
neo4j-admin database load --from-path=/backups/neo4j.dump neo4j

Backup Strategy

Environment	Recommendation
Production	Daily full backups + frequent incremental backups
Development	Weekly dumps
AuraDB	Automatic — managed by Neo4j (snapshots and point-in-time recovery)

---

Security

Authentication

Neo4j supports multiple authentication providers:

Provider	Description
Native	Username/password managed by Neo4j
LDAP	Integrate with Active Directory or LDAP
SSO (OIDC)	Single sign-on via OpenID Connect (Enterprise)

Role-Based Access Control (Enterprise)

Built-in Role	Permissions
reader	Read-only access to all databases
editor	Read and write access to all databases
publisher	Read, write, and create new labels/types
architect	Full schema management (indexes, constraints)
admin	Full database and server administration

Custom roles

CREATE ROLE data_analyst;
GRANT READ {*} ON GRAPH * TO data_analyst;
GRANT MATCH {*} ON GRAPH * TO data_analyst;

Property-Level Security (Enterprise)

Restrict access to specific properties:

DENY READ {salary} ON GRAPH hr TO data_analyst;

Encryption

Type	Configuration
Bolt TLS	dbms.ssl.policy.bolt.enabled=true
HTTPS	dbms.ssl.policy.https.enabled=true
Cluster TLS	dbms.ssl.policy.cluster.enabled=true

---

Monitoring

Built-in Monitoring

// List running queries
SHOW TRANSACTIONS

// List active databases
SHOW DATABASES

// Database store size
CALL dbms.queryJmx("org.neo4j:*")

Key Metrics to Monitor

Metric	Why It Matters
Heap usage	High heap usage causes GC pauses and potential OOM
Page cache hit ratio	Low ratio means frequent disk I/O
Transaction count	Track read/write throughput
Query execution time	Identify slow queries
Bolt connections	Monitor active client connections
Cluster status	Leader/follower health in clusters

Monitoring Tools

Tool	Description
Neo4j Ops Manager	Web-based monitoring and management (Enterprise)
Prometheus + Grafana	Export metrics via the Prometheus endpoint
JMX	Java Management Extensions for JVM metrics
Query Log	Log slow queries for analysis

Enable query logging

In neo4j.conf:

db.logs.query.enabled=INFO
db.logs.query.threshold=1s

This logs all queries that take longer than 1 second.

---

Scaling Neo4j